CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF File Read Proof-of-Concept exploit for CVE-2022-46364 — an Apache CXF server-side request forgery SSRF vulnerability in MTOM/XOP request processing. Vulnerability Summary CVE-2022-46364 affects Apache CXF versions before 3.4.10 and 3.5.5. When MTOM Messag...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

CVE-2024-28752

Ambiente di riproduzione di Apache CXF CVE-2024-28752 Avviso di vulnerabilità: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Avvio dell'ambiente samples/javafirstjaxwsfactorybean IDEA Avviare il servizio webservice tramite ServerStarter.java Build Usare JDK8 root@kitploit: mv...

asf__cxf_CVE-2019-17573_3-2-11

Bem-vindo ao Apache CXF! O Apache CXF é um framework de serviços de código aberto. O CXF ajuda você a construir e desenvolver serviços usando APIs de programação frontend, como JAX-WS e JAX-RS. Esses serviços podem falar uma variedade de protocolos, como SOAP, XML/HTTP, HTTP RESTful ou CORBA, e...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Autore: 0xmid00 Vulnerabilità: SSRF / Lettura file locale tramite XOP:Include nelle richieste MTOM Interessati: Apache CXF 3.5.5 e 3.4.10 Cos'è la Vulnerabilità? Apache CXF elabora messaggi MTOM Message Transmission Optimization Mechanism che...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Exploit da SSRF a LFI di Apache CXF MTOM XOP:Include ⚠️ DICHIARAZIONE DI NON RESPONSABILITÀ QUESTO STRUMENTO È SOLO PER TEST DI SICUREZZA EDUCATIVI E AUTORIZZATI Questo exploit proof-of-concept è fornito a scopo educativo per aiutare i professionisti della sicurezza a comprendere l...

asf__cxf_CVE-2016-6812_3-0-11

toolchain-integration-tests jdk-cxf-with-toolchain Currently disabled due to https://issues.apache.org/jira/browse/CXF-7714 This project contains sample maven module using cxf-codegen-plugin to generate java from WSDL file. it enforces usage of JDK 1.9 or higher to run the mvn command it configur...

CVE-2026-61466

A flaw was found in Apache CXF. The OAuth2 Dynamic Client Registration endpoint in Apache CXF does not properly validate the scope value provided during client registration. This oversight allows a malicious client to assign itself privileged access scopes, potentially leading to unauthorized...

CVE-2022-46364-htb-ctf

Ferramenta de Exploração SOAP DevArea CVE-2022-46364 Descrição Este exploit especializado tem como alvo o ambiente DevArea no Hack The Box. Ele aproveita uma vulnerabilidade crítica no Apache CXF 3.2.14 CVE-2022-46364 para realizar Inclusão de Arquivo Local LFI e Falsificação de Solicitação do La...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Übersicht Dieses Repository enthält einen Proof-of-Concept PoC-Exploit für CVE-2022-46364 , eine Local File Inclusion LFI-Sicherheitslücke in Apache CXF. Die Sicherheitslücke entsteht durch unsachgemäße Handhabung von XOP XML-binary Optimized Packaging...

CVE-2026-63687

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

CRLF Injection

Apache CXF is vulnerable to CRLF Injection. The vulnerability is due to unsanitized clientId values from HTTP requests being directly included in OAuth2 server log messages, which allows an attacker to inject arbitrary content or forged log entries into server log files...

Improper Validation Of Specified Type Of Input

Apache CXF is vulnerable to Improper Validation of Specified Type of Input. The vulnerability is due to incomplete validation of untrusted JMS configuration, which allows an attacker who can configure JMS for Apache CXF to inject malicious configuration and potentially execute arbitrary code...

XML External Entity (XXE) Injection

Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

Improper Access Control

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-66909

A flaw was found in Apache CXF. The Java Message Service JMS transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service's JMS destination. This vulnerability could lead ...

IBM WebSphere Application Server 9.x < 9.0.5.29 / Liberty 17.0.0.3 < 26.0.0.9 (7283567)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7283567 advisory. - An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and affect WebSphere Application Server Liberty when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled. Vulnerability Details CVEID:CVE-2026-57819...